✓ Survived Rank 1 of 18 proposedIndie Security Nov 4, 2026

Tamper detection for AI agent configs and MCP servers

Continuously scans developer machines for silently installed agent plugins, self-approved hooks, and rogue remote MCP endpoints in Claude Code, Codex, and Cursor.

Open the discussion ↗

A ready-to-paste brief for Claude Code, Cursor or any coding agent.

I want to build a small, bootstrappable product. Help me plan and start the MVP.

Product: Tamper detection for AI agent configs and MCP servers
What it is: Continuously scans developer machines for silently installed agent plugins, self-approved hooks, and rogue remote MCP endpoints in Claude Code, Codex, and Cursor.
Who pays: Platform/security engineering leads at 100–2,000 person software companies rolling out AI coding agents; $200–800/mo team plan or $5–15/seat from the security tooling budget.
Closest alternatives: mcp-scan (Invariant Labs/Snyk), Snyk / Cisco AI security posture tools, generic EDR like CrowdStrike or Defender for Endpoint
The gap: Existing tools are point-in-time MCP scanners or generic endpoint agents; none continuously watch the actual agent-host config files (plugin marketplaces, hooks.state trusted hashes, MCP endpoint registrations) across a fleet of dev machines, diff them, alert on self-approval patterns, and offer one-click rollback.
Why now: The MCP/agent-plugin ecosystem exploded in the last ~12 months and this exact incident (1464 points, top of HN) just demonstrated a mainstream vendor abusing the installation surface; agent host trust models are new and unguarded.
Moat to build toward: A growing rule corpus of agent-host file formats, trust-record schemas, and known-bad installer behaviors across Claude Code/Codex/Cursor and future hosts; org-wide baseline data creates switching cost.
Biggest risk: Agent hosts (Anthropic, OpenAI) harden their own installers and ship built-in integrity checks, commoditizing the detection layer.

First three steps:
1. Build a CLI that snapshots and diffs ~/.codex, ~/.claude, and Cursor config trees, flagging new plugins, hooks, trusted_hash entries, and remote MCP URLs.
2. Ship a detection ruleset for self-approval patterns (installer writing its own trust record) plus a rollback/uninstall command per host.
3. Add a lightweight team mode that uploads diffs to a dashboard with alerts for security leads.

Start by asking me up to five questions about constraints (stack, budget, timeline), then propose the smallest version a paying customer would use, and scaffold it.

Overall6.5/10

Pain7

Willingness to pay6

Timing8

Gap6

Moat5

Feasibility7

For

Who pays

Platform/security engineering leads at 100–2,000 person software companies rolling out AI coding agents; $200–800/mo team plan or $5–15/seat from the security tooling budget.

What people said · 3

Postman's installer auto-installed plugins into Codex and Claude Code, wrote its own trusted_hash to approve its startup hook, and registered a remote MCP endpoint without user consent. From the article ↗
Commenter flags the incident as circumvention of the agent harness trust model, prompt injection, and silent registration of an outbound remote MCP endpoint. Read the comment ↗
Commenter discovered Postman proxying requests with sensitive data without permission, only catching it via firewall rules. Read the comment ↗

Paraphrased from the discussion. Follow the links for the original comments.

Competitors and gap

mcp-scan (Invariant Labs/Snyk)Snyk / Cisco AI security posture toolsgeneric EDR like CrowdStrike or Defender for Endpoint

Existing tools are point-in-time MCP scanners or generic endpoint agents; none continuously watch the actual agent-host config files (plugin marketplaces, hooks.state trusted hashes, MCP endpoint registrations) across a fleet of dev machines, diff them, alert on self-approval patterns, and offer one-click rollback.

Why now

The MCP/agent-plugin ecosystem exploded in the last ~12 months and this exact incident (1464 points, top of HN) just demonstrated a mainstream vendor abusing the installation surface; agent host trust models are new and unguarded.

Moat · 5/10

A growing rule corpus of agent-host file formats, trust-record schemas, and known-bad installer behaviors across Claude Code/Codex/Cursor and future hosts; org-wide baseline data creates switching cost.

Against

Red team: mcp-scan is point-in-time and EDR is agent-host-agnostic; continuous fleet-level diffing of agent trust records with rollback is a genuine, freshly demonstrated gap with strong timing.
What would kill it: Agent hosts (Anthropic, OpenAI) harden their own installers and ship built-in integrity checks, commoditizing the detection layer.

Start

First three steps: Build a CLI that snapshots and diffs ~/.codex, ~/.claude, and Cursor config trees, flagging new plugins, hooks, trusted_hash entries, and remote MCP URLs.
Ship a detection ruleset for self-approval patterns (installer writing its own trust record) plus a rollback/uninstall command per host.
Add a lightweight team mode that uploads diffs to a dashboard with alerts for security leads.
Source discussion: Postman silently auto-installs AI plugins and attempts to share all API data ↗ 1,464 points477 commentsFrom the storyLinked article

#	Score	Idea	Track	Category	Pain	Pay	Time	Gap	Moat	Build
1	6.4	Operations platform for headless Mac build fleetsFleet ops software that automates recovery, unlocking and imaging for racks of headless Macs used as CI build nodes.	Indie	DevTools	7	6	7	6	5	7
2	6.2	Continuous adversarial testing for fraud defense stacksA red-team service that attacks your fraud rules and models with simulated adaptive fraudsters, measuring how fast each defense gets bypassed before real attackers find out.via Show HN	Venture	Security	7	6	6	7	5	5

For

Against

Start

More from this issue